In plain EnglishThis is the contract that protects your students’ data. Your school stays in control; nOS only processes data to run the Service for you.
This Student Data Privacy and Data Processing Agreement (“DPA”) is between nOS LLC, a North Carolina limited liability company (“nOS”), and the school, district or other educational organization whose authorized representative signs it in the Service (the “School”). It supplements the nOS Terms of Service and governs how nOS handles School Data in providing nOS AI Assistant (the “Service”). If this DPA conflicts with the Terms of Service or any other document on the handling of Student Data, this DPA controls.
1. Definitions
In plain EnglishThe key words, defined once.
“Student Data” means any information that identifies, or is linked or reasonably linkable to, an individual student and that the School or its users provide to the Service, whether uploaded, read from a student information system (“SIS”), or typed into a conversation, including education records as defined by FERPA. “Staff Data” means comparable information about the School’s teachers and staff. “School Data” means Student Data, Staff Data, the school profile entered during setup, and all other data the School provides. “Authorized User” means a person the School has allowed into its account. “Subprocessor” means a third party nOS engages to process School Data on its behalf. “Security Incident” has the meaning in Section 9.
2. Roles, ownership and instructions
In plain EnglishYour school owns the data and decides how it is used. nOS follows your instructions and never writes to your SIS.
2.1 The School owns and controls all School Data. Nothing in this DPA or the Terms of Service transfers ownership of School Data to nOS. The School acts as the party that decides why and how School Data is processed; nOS acts only as its service provider and processor.
2.2 nOS processes School Data only on the School’s documented instructions, which are this DPA, the Terms of Service and the School’s use of the Service’s features, unless the law requires otherwise, in which case nOS will tell the School first where the law allows.
2.3 The Service is read-only with respect to the School’s SIS. nOS reads only the data the School authorizes and never writes to, changes or deletes records in the School’s SIS or source files.
3. FERPA
In plain EnglishnOS is your “school official” under FERPA and uses student records only for the purpose you shared them.
3.1 The School designates nOS as a “school official” with a “legitimate educational interest” under the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and 34 C.F.R. § 99.31(a)(1). nOS performs an institutional service for which the School would otherwise use its own employees, is under the School’s direct control with respect to the use and maintenance of education records, and uses Student Data only for the purposes for which it was disclosed.
3.2 nOS will not re-disclose Student Data to any third party except to Subprocessors bound by this DPA, as the School directs, or as required by law. If nOS is compelled by law or legal process to disclose Student Data, it will notify the School before disclosure unless the law prohibits notice, and will disclose only what is required.
3.3 Requests from parents, guardians or eligible students to inspect, review or correct education records are the School’s to answer. nOS will refer any such request it receives to the School within five (5) business days and will help the School fulfill it.
4. Children’s privacy (COPPA)
In plain EnglishStudents do not use nOS. Where COPPA applies, your school consents for its own educational purpose, and nOS uses the data for nothing else.
The Service is used by School staff, not by students, and nOS does not knowingly collect personal information directly from children. To the extent the Children’s Online Privacy Protection Act applies to Student Data the School provides, the School consents on behalf of parents to the collection and use of that data solely for the School’s educational purposes, and nOS uses it for no other purpose. The School is responsible for any parental notice its own policies or state law require.
5. State student-privacy laws
In plain EnglishnOS follows the state student-privacy laws that apply to your school, and will sign a state-standard addendum on request.
nOS complies with the state student-privacy laws that apply to the School’s use of the Service, including laws modeled on California’s Student Online Personal Information Protection Act (SOPIPA) and similar statutes in other states. Where a state requires specific contract terms or a standard data privacy agreement (for example, New York Education Law § 2-d or a state consortium agreement), nOS will negotiate that addendum in good faith on the School’s request, and the addendum will control where it is more protective.
6. What nOS will never do
In plain EnglishNo selling, no advertising, no AI training, no other uses.
6.1 nOS will not sell, rent, trade or otherwise transfer Student Data for any commercial purpose.
6.2 nOS will not use Student Data to target advertising to students, families or staff, or to build advertising or marketing profiles.
6.3 nOS will not use School Data to train, fine-tune or improve any artificial-intelligence model, and does not permit its Subprocessors to do so.
6.4 nOS will not use Student Data for any purpose other than providing, securing and supporting the Service for the School. nOS may use aggregate measurements of how the Service is used (for example, how many questions were asked) to operate and improve it; these never contain Student Data.
7. Subprocessors
In plain EnglishThese are the only companies that help nOS run the Service. We will tell you before adding one that handles student data.
7.1 nOS uses the following Subprocessors, each a United States company bound by written data-protection terms at least as protective of School Data as this DPA, and each storing School Data in the United States: Vercel Inc. (application hosting, serverless compute, and storage of uploaded files); Neon, Inc. (managed PostgreSQL database); Anthropic PBC (AI model API that generates the assistant’s answers; inputs are not used to train its models and are subject to limited retention); Stripe, Inc. (billing and payments; receives account and payment details only, never Student Data); Google LLC, through Google Workspace (transactional email to Authorized Users; never Student Data), with Resend, Inc. as a backup email provider on the same terms; and, only where the School’s deployment has these features turned on, Voyage AI Innovations, Inc. (converts conversation text into search embeddings) and Functional Software, Inc. d/b/a Sentry (error reports, with personal data removed before they are sent).
7.2 nOS will give the School at least thirty (30) days’ notice before adding a Subprocessor that will process Student Data. If the School reasonably objects and the parties cannot resolve the objection in good faith, the School may end the Service without penalty and receive a pro-rated refund of any prepaid fees for the remaining term.
7.3 nOS remains responsible for its Subprocessors’ compliance with this DPA.
8. Security
In plain EnglishEncryption, strict separation between schools, limited access, and logs of who did what.
nOS maintains administrative, technical and physical safeguards appropriate to the sensitivity of Student Data, including: encryption of data in transit with TLS; encryption of data at rest by its database and storage providers; encryption of stored SIS credentials with AES-256-GCM; strict logical separation of each School’s data, with every query scoped to the School’s account; role-based access within the School’s account (owner, admin, member), with student export and erasure limited to owners and admins; passwords stored only as bcrypt hashes, optional two-factor authentication, and sessions that expire after inactivity; rate limiting on sign-in and other sensitive operations; an activity log visible to the School and an audit log of every operator action taken on a School’s account; a programmatic block that prevents student or staff identifiers from being sent in web-search queries; confidentiality duties for everyone at nOS who can access School Data; and limiting that access to the people who need it to operate and support the Service.
9. Security incidents
In plain EnglishIf student data is exposed, nOS tells you within 72 hours and helps you respond.
9.1 If nOS confirms unauthorized access to, or acquisition or disclosure of, Student Data in its or its Subprocessors’ systems (a “Security Incident”), nOS will notify the School without undue delay and in any event within seventy-two (72) hours of confirmation.
9.2 The notice will describe, to the extent known, what happened and when, the categories and approximate number of records and individuals affected, the steps nOS has taken to contain it, and a contact for further information. nOS will update the notice as it learns more.
9.3 nOS will cooperate with the School’s investigation and with any notice the School must give to parents, students, staff or regulators, and will bear the reasonable cost of notices required because of nOS’s breach of this DPA.
10. Access, export, correction and deletion
In plain EnglishYour owners and admins can export or erase any student themselves, at any time. We will help with anything else within 30 days.
10.1 The Service lets the School’s owners and admins, at any time and without asking nOS: export a complete record of everything the Service holds about an individual student or staff member; erase an individual, either by anonymizing them (keeping roster totals correct) or by deleting them, which also scrubs their details from imported rows and extracted document text; and delete schedule versions and their uploaded files.
10.2 Because an original uploaded file is kept exactly as uploaded, fully removing an individual from an older import requires deleting that schedule version or re-importing a corrected file. Conversation text that mentions an individual by name is not changed by individual erasure; the School may delete those conversations, or ask nOS to.
10.3 On written request from the School, nOS will correct, export or delete specific School Data within thirty (30) days.
11. Retention and deletion when the account closes
In plain EnglishWhen you close your account there is a 14-day window to change your mind, then everything is permanently deleted.
11.1 nOS keeps School Data only while the School’s account is active and as described in this Section. Operational records are removed on the schedule published in the nOS Privacy Policy.
11.2 When the School deletes its account, or the Service ends, every Authorized User is locked out and billing is cancelled immediately. School Data is then held for a grace period of fourteen (14) days, during which the School may ask nOS to restore the account or to provide an export. After the grace period, nOS permanently deletes the account and all School Data in it, including uploaded files, from its production systems within one (1) further day.
11.3 Copies in the database provider’s encrypted backups and point-in-time recovery history are overwritten in the ordinary course within thirty (30) days after production deletion. nOS does not restore deleted School Data from backups except to recover from a disaster, and any data so recovered is deleted again.
11.4 Data held by the AI Subprocessor to generate answers is governed by that provider’s limited-retention terms and is not kept by nOS beyond the conversation stored in the School’s account.
11.5 Records of signed agreements are kept for as long as either party may need them to show what was agreed. On request, nOS will certify in writing that School Data has been deleted.
12. Audits and assurance
In plain EnglishOnce a year, we will answer your security questionnaire.
On reasonable written request, not more than once a year (or after a Security Incident), nOS will answer the School’s security questionnaire and provide documentation reasonably needed to show compliance with this DPA.
13. Term, changes and signature
In plain EnglishThis lasts as long as you use nOS. A new version applies to you only once your school signs it.
13.1 This DPA takes effect when signed in the Service and lasts as long as the School uses the Service, and afterwards until all School Data has been deleted as described in Section 11.
13.2 nOS will not make a change that reduces the protection of Student Data under this DPA without at least thirty (30) days’ written notice to the School’s owners and admins. A new version takes effect for the School only when an authorized representative signs it; until then the version the School signed continues to apply.
13.3 The School’s representative signs this DPA electronically in the Service by typing their full name, title and the School’s name and confirming their authority to bind the School. The signature, the time, the signer’s IP address and browser, the version, and a SHA-256 hash of this exact text are recorded, and the School can download a signed copy at any time from Settings → Agreements. nOS LLC’s execution is on file. Notices to nOS: bennettmiller@nosplanner.com.
Last updated October 16, 2026.